Poco::Data::Statement statement(createSession()); // why should something like this not work?

Because

ISO/IEC 14882, 12.2.3 wrote:Temporary objects are destroyed as the last step in evaluating the full expression (1.9) that (lexically) contains the point where they were created.

Although you return a copy from createSession(), the Statement constructor takes a reference to it (and passes that reference to StatementImpl). Once the above statement is done, the original session you created does not exist anymore.